Annex A of ISO 27001 is a catalogue of information security controls that organisations use to treat the risks identified during their risk assessment. It is not a prescriptive checklist — rather, it serves as a reference set from which organisations select controls that are proportionate to their risk landscape, regulatory obligations, and business context. Each control in Annex A corresponds to detailed implementation guidance published in ISO 27002, the companion standard that explains how to put each control into practice.
Understanding Annex A is essential for anyone pursuing ISO 27001 certification. The controls define the scope of what auditors evaluate, shape the Statement of Applicability, and ultimately determine the practical security measures an organisation must implement and maintain.
The 2022 Update: From 114 to 93 Controls
The 2022 revision of ISO 27001 brought the most significant restructuring of Annex A since the standard’s original publication. The previous edition (ISO 27001:2013) organised 114 controls across fourteen domains, ranging from asset management to supplier relationships. While comprehensive, this structure had become unwieldy — controls overlapped between domains, naming conventions were inconsistent, and the fourteen-domain taxonomy made it difficult to assign clear ownership within organisations.
ISO 27001:2022 consolidated these 114 controls into 93, organised under four thematic categories. Fifty-seven controls were merged from multiple previous controls, twenty-four were renamed for clarity, one was split into separate controls, and eleven entirely new controls were introduced to address threats and technologies that did not exist or were not prevalent when the 2013 edition was drafted.
The four themes replace the fourteen domains and provide a cleaner taxonomy that aligns more naturally with how security teams are structured:
| Theme | Control Numbers | Count | Focus |
|---|---|---|---|
| Organisational | 5.1 – 5.37 | 37 | Governance, policies, roles, supplier and asset management |
| People | 6.1 – 6.8 | 8 | Screening, awareness, responsibilities, remote working |
| Physical | 7.1 – 7.14 | 14 | Facilities, equipment, media, physical access |
| Technological | 8.1 – 8.34 | 34 | Identity, access, cryptography, operations, development |
Each control also carries a set of attributes introduced in ISO 27002:2022 — control type (preventive, detective, corrective), information security properties (confidentiality, integrity, availability), cybersecurity concepts (identify, protect, detect, respond, recover), and operational capabilities — that allow organisations to filter and group controls by function rather than by theme alone.
Organisational Controls (5.1 – 5.37)
The organisational theme is the largest, containing 37 controls that establish the governance framework within which all other controls operate. These controls address how information security is directed, managed, and sustained at an institutional level.
Policies and roles (5.1 – 5.6) require organisations to define an information security policy approved by management, assign specific security roles and responsibilities, ensure segregation of duties, and establish contact with relevant authorities and special interest groups. In practice, this means maintaining a board-approved information security policy, appointing an information security manager or officer, and documenting which teams own which control domains.
Threat intelligence (5.7) is one of the eleven new controls. It requires organisations to collect, analyse, and act upon information about current and emerging threats. Implementation typically involves subscribing to threat intelligence feeds, participating in industry information-sharing communities (such as ISACs), and integrating threat data into risk assessment and incident response processes.
Asset management and classification (5.9 – 5.14) covers the identification of information assets, acceptable use policies, asset return upon termination, information classification schemes, and the labelling and transfer of information. Organisations must maintain an asset inventory, classify information by sensitivity level, and apply handling rules that govern how data is stored, transmitted, and destroyed.
Access control (5.15 – 5.18) defines requirements for access control policies, identity management, authentication, and access rights. These controls mandate role-based access, least-privilege principles, periodic access reviews, and formal processes for granting and revoking access. A practical implementation includes centralised identity providers, automated provisioning and de-provisioning linked to HR systems, and quarterly access certifications.
Supplier management (5.19 – 5.22) addresses the information security risks introduced by third-party relationships. Organisations must assess supplier risk before engagement, include security requirements in contracts, monitor supplier performance, and manage security across the supply chain. This translates into vendor risk assessments, contractual clauses covering data handling and breach notification, and regular supplier audits or questionnaire programmes.
Cloud services (5.23) is another new control that requires organisations to define and manage security for cloud service acquisition, use, management, and exit. Practically, this means establishing a cloud governance policy, evaluating cloud providers against security criteria, configuring cloud environments to organisational standards, and maintaining exit strategies to avoid vendor lock-in.
Incident management (5.24 – 5.28) requires incident response planning, assessment and decision-making processes for security events, evidence collection, business continuity integration, and learning from incidents. Organisations need a documented incident response plan, defined severity classifications, forensic evidence handling procedures, and post-incident review processes.
ICT readiness for business continuity (5.30) is a new control mandating that ICT services are planned, implemented, maintained, and tested to ensure business continuity. This goes beyond traditional disaster recovery by requiring organisations to define recovery time objectives, test failover procedures, and ensure that ICT continuity plans align with broader business continuity requirements.
People Controls (6.1 – 6.8)
The people theme is deliberately concise, containing eight controls that address the human element of information security throughout the employment lifecycle.
| Control | Title | Practical Example |
|---|---|---|
| 6.1 | Screening | Background checks, reference verification, and qualification confirmation before employment |
| 6.2 | Terms and conditions of employment | Security responsibilities, confidentiality obligations, and acceptable use terms in employment contracts |
| 6.3 | Information security awareness, education and training | Role-specific security training programmes with completion tracking and periodic refreshers |
| 6.4 | Disciplinary process | Documented process for addressing security policy violations, applied consistently |
| 6.5 | Responsibilities after termination or change of employment | Ongoing confidentiality obligations, return of assets, and access revocation upon departure |
| 6.6 | Confidentiality or non-disclosure agreements | NDAs for employees, contractors, and third parties with access to sensitive information |
| 6.7 | Remote working | Security requirements for remote access, including device management, network security, and physical workspace considerations |
| 6.8 | Information security event reporting | Clear reporting channels and the obligation for all personnel to report suspected security events |
Remote working (6.7) received increased emphasis in the 2022 update, reflecting the shift toward distributed work. Organisations must address not only the technical controls for remote access — VPNs, endpoint protection, secure Wi-Fi requirements — but also the physical security of remote workspaces and the handling of confidential information outside the office.
Physical Controls (7.1 – 7.14)
The physical theme covers the tangible security of premises, equipment, and media. While these controls may seem straightforward, they are frequently the source of audit findings because organisations focus heavily on technical and administrative controls at the expense of physical measures.
Perimeter and access controls (7.1 – 7.3, 7.6) require defined security perimeters, physical entry controls, and securing offices, rooms, and facilities. This includes swipe card or biometric access to sensitive areas, visitor management procedures, and separate secure zones for server rooms and data centres.
Physical security monitoring (7.4) is a new control requiring continuous monitoring of premises for unauthorised physical access. Implementation involves CCTV surveillance, intrusion detection sensors, and security guards, with retention policies for monitoring recordings and clear procedures for reviewing alerts.
Environmental controls (7.5, 7.8 – 7.12) address protection against environmental threats — fire, flood, power failure, temperature extremes — as well as equipment maintenance, secure disposal, the clear desk and clear screen policy, and equipment siting. Practical measures include uninterruptible power supplies, climate-controlled server rooms, secure media destruction services, and policies requiring workstations to be locked when unattended.
Working in secure areas (7.6) and equipment and media management (7.7, 7.9 – 7.14) cover the controls for cabling security, secure disposal or reuse of equipment, and the protection of assets located off-premises.
Technological Controls (8.1 – 8.34)
The technological theme contains 34 controls addressing the technical implementation of information security. This is where the majority of the new controls introduced in 2022 reside, reflecting the evolution of the threat landscape and technology stack since 2013.
User endpoint and access (8.1 – 8.5) covers user endpoint devices, privileged access rights, information access restriction, and access to source code. Organisations must implement mobile device management, privileged access workstations, just-in-time access for administrative functions, and repository access controls for source code.
Authentication and identity (8.5) requires secure authentication mechanisms proportionate to the sensitivity of the system being accessed. Multi-factor authentication is the baseline expectation for any system handling sensitive data, with stronger mechanisms such as hardware tokens or certificate-based authentication for critical infrastructure.
Malware and vulnerability management (8.7 – 8.8) requires protection against malware and the management of technical vulnerabilities. This translates into endpoint detection and response platforms, automated vulnerability scanning, patch management processes with defined timelines, and penetration testing programmes.
Configuration management (8.9) is a new control requiring organisations to define, document, implement, monitor, and review configurations across hardware, software, services, and networks. In practice, this means infrastructure-as-code, configuration baselines, drift detection tooling, and change control processes that prevent unauthorised configuration changes.
Data protection controls (8.10 – 8.12) include three new controls. Information deletion (8.10) requires defined processes for securely deleting data when it is no longer needed. Data masking (8.11) mandates techniques such as pseudonymisation, tokenisation, or anonymisation to protect sensitive data in non-production environments. Data leakage prevention (8.12) requires measures to detect and prevent the unauthorised disclosure of information, typically implemented through DLP tools that monitor email, cloud storage, and endpoint file transfers.
Monitoring and logging (8.15 – 8.16) requires comprehensive logging of activities, exceptions, faults, and events, along with monitoring activities (8.16, a new control) that go beyond log collection to include active analysis, anomaly detection, and automated alerting. Security information and event management (SIEM) platforms are the standard implementation, often augmented with security orchestration and automated response (SOAR) capabilities.
Network and application security (8.20 – 8.28) covers network controls, web filtering (8.23, new), and secure coding (8.28, new). Web filtering requires organisations to manage access to external websites to reduce exposure to malicious content. Secure coding requires that software development follows security principles — input validation, output encoding, secure dependency management, and code review processes.
Cryptography (8.24) requires the use of cryptographic controls in accordance with a defined policy, including key management procedures. Organisations must define encryption standards for data at rest and in transit, manage cryptographic key lifecycles, and ensure that cryptographic measures comply with applicable regulations.
The Statement of Applicability
The Statement of Applicability (SoA) is the document that bridges the risk assessment and the control implementation. It lists all 93 Annex A controls and records, for each one, whether it is applicable, the justification for its inclusion or exclusion, the implementation status, and references to supporting policies or procedures.
The SoA serves multiple purposes. For the organisation, it is the master control index that drives implementation planning and ongoing management. For certification auditors, it is the primary document for scoping the audit — auditors verify that the SoA accurately reflects the risk assessment, that excluded controls have legitimate justifications, and that included controls are implemented and effective.
Common pitfalls with the SoA include excluding controls without adequate justification (particularly physical controls by organisations that assume cloud-only environments eliminate physical risk), failing to update the SoA when the risk landscape changes, and treating the SoA as a one-time certification document rather than a living record.
Mapping Annex A Controls to SOC 2 Trust Service Criteria
Organisations pursuing both ISO 27001 certification and SOC 2 attestation benefit from understanding how the two frameworks overlap. While the structures differ — Annex A is control-based, SOC 2 is criteria-based — the underlying security objectives are closely aligned.
| ISO 27001 Annex A Theme | Key Control Areas | SOC 2 Trust Service Criteria |
|---|---|---|
| Organisational (5.x) | Risk assessment, access control policy, incident management, supplier management | CC3 (Risk Assessment), CC6 (Logical and Physical Access), CC7 (System Operations), CC9 (Risk Mitigation) |
| People (6.x) | Screening, awareness training, employment terms | CC1 (Control Environment), CC2 (Communication and Information) |
| Physical (7.x) | Physical access controls, environmental protection, equipment security | CC6 (Logical and Physical Access) |
| Technological (8.x) | Authentication, encryption, logging, vulnerability management, secure development | CC6 (Logical and Physical Access), CC7 (System Operations), CC8 (Change Management), Confidentiality, Availability |
The mapping is not one-to-one. SOC 2 Common Criteria (CC1 through CC9) address governance, risk, and control environment concerns that span multiple Annex A themes. Conversely, some Annex A controls — particularly the new controls around threat intelligence, data masking, and web filtering — do not have direct SOC 2 equivalents but support the broader security posture that SOC 2 auditors evaluate.
Organisations that build their control environment with both frameworks in mind can implement controls once and evidence them for both audits, significantly reducing duplication of effort. A unified control register that maps each control to its applicable Annex A reference and SOC 2 criterion is the most effective approach to managing this overlap.
Approaching Annex A Implementation
Implementing Annex A controls is not a linear process. Organisations should begin with a thorough risk assessment that identifies which controls are relevant, prioritise controls based on risk severity and regulatory requirements, and implement iteratively rather than attempting to deploy all applicable controls simultaneously.
The most effective approach groups controls by operational capability — access management, asset management, threat and vulnerability management, incident management — rather than by Annex A numbering. This aligns control ownership with the teams that will operate and maintain them, ensuring that controls remain effective beyond the initial certification audit.
Automation plays a critical role in sustaining Annex A compliance. Controls that rely on manual processes — periodic access reviews, evidence collection, policy acknowledgements — are the most likely to degrade over time. Platforms that automate evidence gathering, track control effectiveness continuously, and alert teams when controls drift from their expected state transform ISO 27001 compliance from a periodic certification exercise into an ongoing operational capability.